Privacy Policy

Last updated: 5 August 2026

1. Who is responsible

subscriptions.my operates this service and is the controller for the personal data described below. For any privacy question or request, write to privacy@subscriptions.my.

2. What we collect

Account data. Your name, email address and — if you sign in with Google — the profile picture Google returns. If you sign up with an email address and password, we store a hash of that password, never the password itself.

Session data. When you are signed in we store a session token, its expiry, and the IP address and browser user agent of the device that created the session. This is what keeps you logged in and lets us detect suspicious sign-ins.

Content you enter. The subscriptions you track — name, price, currency, billing cycle, next payment date, status, category and icon. This data is yours; we do not analyse it beyond showing it back to you.

Billing data.If you buy Premium, we store the Paddle customer and subscription identifiers, your plan, its status and the current period end. Card details never reach us — they are entered on Paddle's own checkout page and handled by Paddle.

Alert and email data. For Premium renewal reminders we keep a history of price changes on your subscriptions, and a log of which reminder was sent to you for which subscription and when, so the same reminder is not sent twice.

We do not run analytics, advertising or third-party tracking on this site.

3. Why we process it, and on what legal basis

• To provide the service — creating your account, storing your subscriptions, showing your dashboard. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• To keep accounts secure — session handling, abuse and fraud prevention. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
• To handle payments for Premium — creating the checkout session, keeping your plan status current, giving you access to the billing portal. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• To send renewal reminder emails to Premium users about their own upcoming renewals. These are part of the feature you paid for, not marketing. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• To meet legal obligations where applicable, including keeping billing records for the retention periods required by German tax and commercial law. Legal basis: Art. 6(1)(c) GDPR.

4. Cookies

We set one strictly necessary cookie, the session cookie that keeps you signed in. It is removed when you log out or when the session expires. No consent banner is shown because we set no optional cookies.

5. Who else sees the data

• Neon — our database host. Your account and subscription data is stored there on our behalf.
• Google — only if you choose to sign in with Google. Google then tells us your name, email address and profile picture, and processes the sign-in under its own privacy policy.
• Paddle — only if you buy Premium. Paddle is the merchant of record for Premium purchases: it processes your payment and the details you enter on its checkout page as its own controller, under its own privacy policy, and tells us the plan status we need to unlock the features. Paddle is based in the United States; transfers rest on the EU standard contractual clauses.
• Resend — only if you are on Premium. It delivers the renewal reminder emails on our behalf and therefore processes your email address and the contents of those emails.
• Our hosting provider — serves the application and processes connection data such as IP addresses in server logs.

We do not sell your data and do not share it with anyone else unless the law requires it.

6. How long we keep it

Account and subscription data stays until you delete your account. Deleting your account removes your subscriptions, categories, sessions and linked sign-in providers along with it. Sessions expire and are cleared on their own.

Billing records are the exception: German tax and commercial law (§147 AO, §257 HGB) requires us to keep records of payments for up to ten years, so those stay even after you delete your account. Everything Paddle holds about the payment follows Paddle's own retention.

7. Your rights

Under the GDPR you can request access to your data, correction of wrong data, deletion, restriction of processing, a portable copy, and you can object to processing based on legitimate interest. Where processing rests on consent, you can withdraw it at any time without affecting past processing.

Send any of these requests to privacy@subscriptions.my. You also have the right to complain to a data protection supervisory authority in the country where you live or work.

8. Changes to this policy

If we change how data is processed, we update this page and the date at the top. Material changes will be announced in the app before they take effect.